1. System state models

2. Bell-LaPadula Confidentiality model
Subjects and objects
Simple security property
Only read information at current or lower levels
NO READ UP
*-property
Can write information at higher but not read it
NO WRITE UP
Strong * property
Only access information (R+W) at current level

3. BLP problems Does not address confidentiality issues: need to know
restrict individuals objects based on subject needs

4. Biba Integrity Model Focus is to prevent corruption
Assigns integrity levels to subjects and objects

5. Bell LaPadula verses Biba
Property
Bell LaPadula
Biba
Model focus
Confidentiality
Integrity
Simple security property
No READ up
A subject cannot observe an object of lower integrity
*-property
No WRITE down
A subject cannot modify an object of higher integrity
Example
Secret military documents
Two decimal places in FX calculations

6. Clark-Wilson Transaction Integrity model
Prevents undesirable changes by authorised subjects
Separation of duties
Ensures external consistency by the SOD check
For internal consistency, the steps within the transaction must be well formed

7. Lipner model Model 1 (based on BLP) Model 2 (based on BLP and Biba)
assigns subjects to one of two security levels and one of four job categories
Subjects are confined to data in their domains
Model 2 (based on BLP and Biba)
Programs control access to data
Addresses confidentiality and integrity

8. Brewer-Nash (Chinese Wall)